diff --git a/roles/routeros/files/download-routeros-firmware.sh b/roles/routeros/files/download-routeros-firmware.sh
index 96260ca..56f0cd0 100755
--- a/roles/routeros/files/download-routeros-firmware.sh
+++ b/roles/routeros/files/download-routeros-firmware.sh
@@ -2,7 +2,7 @@
 
 set -eu
 
-umask 022
+umask 077
 
 cd /srv/web/oob.foo.sh/routeros
 
@@ -56,6 +56,7 @@ if [ "$(sha256sum "$tmpfile" | cut -d " " -f 1)" != "$checksum" ]; then
 fi
 
 mv "$tmpfile" "$packagename"
+chmod 644 "$packagename"
 
 echo
 curl -sSf "https://cdn.mikrotik.com/routeros/$(echo "$packagename" | cut -d "-" -f 2)/CHANGELOG"